Pages

Saturday, September 9, 2017

The Pirelli Alice Gate VoIP 2 Plus, also known as agpf, is a ADSL modem router with WiFi and Voip capabilities.
The main chip is the BCM6358KFBG, they support OpenWrt.OpenWrt is a linux distribution for embedded devices, you can find further information on the openwrt website: https://openwrt.org. Although hardware Voip and ADSL is not supported on this router, this device can be pretty usefull for other network roles.

I've saved three of them from junkyard and I start playing with that devices.

This post reports how I've built a Access Point and a Routed Access Point for a Guest WiFi using OpenWrt.
Also a wired guest connection is served.

Let's suppose we are serving our main network on 192.168.1.0/24 ip ranges, and we would like a guest network, isolated from the 192.168.1.0/24 one, on the 192.168.2.0/24 ip range.

The following steps is needed only if your router hasn't OpenWrt on board.
The first step to start the game will be load the OpenWrt firmware.The following steps may brick your device, so continue at your risk.
You can find a complete guide here: https://wiki.openwrt.org/toh/pirelli/agpf.
Summarizing it will be very simple, you just have to connect the router to a RS232 port, set the port at 115200 baud, no parity, 8bits and open your terminal software. Here you can the serial connection pins https://wiki.openwrt.org/_media/media/pirelli/alice-agpf.jpg, on the left the GND, top right RX, bottom right TX).
To enter the CFE prompt, you can press any key during the boot process, when the countdown stop message appears.
You have to run a TFTP server, to provide the firmware to your router.
I'm using tftpd32 (http://tftpd32.jounin.net/) and the Chaos Calmer 15.05.1 firmware (https://downloads.openwrt.org/chaos_calmer/15.05.1/brcm63xx/generic/openwrt-15.05.1-brcm63xx-generic-AGV2+W-squashfs-cfe.bin).
Just put the firmware in your tftpd32 folder, run the software and select the server interface to serve.
Supposing your interface is 192.168.1.120, on the CFE prompt you have to run the flashimage command as follow> flashimage 192.168.1.120:openwrt-15.05.1-brcm63xx-generic-AGV2+W-squashfs-cfe.bin
This would load the firmware on your router.
The router will reboot, and you can now access the router by the 192.168.1.1 address on your web browser.
Note: if you would like to change your IP address using serial interface, just edit the network config file using the command$vi /etc/config/network
You should change the ipaddr of the interface 'lan', also you can add your gateway and dns option here.

Now that you have a working OpenWrt device, we can setup it to provide the main WiFi access and a guest WiFi access.

Just open the Luci web interface of your OpenWrt, set your password and enable a SSH access to the main lan. The SSH access allows us to run configuration command throgh a SSH terminal.

Before going on we have to say that the WiFi board of this router does not support multiple SSID, so we have to use a USB adapater.
The following steps is needed only if your OpenWrt router does not supports multiple SSID and you have a RT72 driver compatible device, otherwise you must use your device proper driver.
I've a Ralink RT2501USB/RT2571W usb adapater, to make it work with at AGPF router we have to load the modules for USB and for the adapter.
We will do this by the opkg package system.
After the system reboot, to update the packages repository, we will run the command$opkg update
We will install usbutils and the wireless tools, not closely needed but may be usefull$opkg install usbutils$opkg install wireless-tools
Now we are going to install USB modules$opkg install kmod-usb-uhci$opkg install kmod-usb2
A reboot is needed now.
We will install the Ralink RT2501USB/RT2571W (RT73) module
$opkg install kmod-rt73-usb
We will now reboot.
Now you should see a secondary WiFi on the Luci web interface.

We can now setup the first WiFi interface, and bind that to the lan network.
The DHCP must be disabled on the lan network to simulate an AP bridge behaviour.

We will make a new switch,that is new VLAN.
On VLAN 1, we disable port 2, 3 and 4, set 5 is untagged
On VLAN 2, we enable port 3, 5 is tagged
We are going to use port 3 as a wired guest port.
Note that the port 5 is the CPU, the physical port for port 3 is Eth4, port 2 Eth3.. and so on.

The untagged traffic will run on VLAN 1, the tagged one on VLAN 2.

Now we have to add guest firewall rules for guest interface.

This rule has to accept input, accept output, reject forward and Allow forward to destination zones -> lan, this way all the traffic will be forwared to lan.

The lan firewall rule must have enabled Masquerading and MSS clamping, it also have to Allow forward from source zones -> guest, to accept the forward traffic from guest, and Restrict Masquerading to all subnet but not the 192.168.1.0/24, by the value !192.168.1.0/24.

We can now add a guest interface, as bridge and add the VLAN 2 created on port 3.
We are going to set the guest interface with a static address, and enable DHCP for the guest interface assign the interface to the guest firewall zone.

Now we can set the guest WiFi, binding it to the guest interface.

Now we would have a primary WiFi over our main subnet 192.168.1.0/24, and a guest WiFi + a guest wired connection through port 3 of the router over our secondary subnet 192.168.2.0/24.